Log in / Sign up

Vulnerability details

CVE-2025-66565

gofiber utils

Fiber Utils UUIDv4 and UUID Silent Fallback to Predictable Values

CVSS 4.0
9.3Critical

Official description

Fiber Utils is a collection of common functions created for Fiber. In versions 2.0.0-rc.3 and below, when the system's cryptographic random number generator (crypto/rand) fails, both functions silently fall back to returning predictable UUID values, including the zero UUID "00000000-0000-0000-0000-000000000000". The vulnerability occurs through two related but distinct failure paths, both ultimately caused by crypto/rand.Read() failures, compromising the security of all Fiber applications using these functions for security-critical operations. This issue is fixed in version 2.0.0-rc.4.

CVSS scores

ScoreVersionSourceVector
9.3Critical 4.0 CVEProject cvelistV5 (CNA) (GitHub_M) CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Affected products

VendorProductVersionsSource
gofiber utils github.com/gofiber/utils <= 1.2.0 CVEProject cvelistV5 (CNA)
gofiber utils github.com/gofiber/utils/v2 < 2.0.0-rc.4 CVEProject cvelistV5 (CNA)

References and advisories

2
Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published
2025-12-09
Last updated
2025-12-09
State
Published
Assigner (CNA)
GitHub_M

Exploit prediction (EPSS)

0.46%
Probability of exploitation in 30 days
40.7%
Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable
Yes
Exploitation
Proof of concept
Technical impact
Total

Weaknesses (CWE)

  • CWE-252
    Unchecked Return Value
  • CWE-331
    Insufficient Entropy
  • CWE-338
    Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)